Authentication Bypass in MOOSDB HTTP Server

MOOS core-moos versions up to and including 10.4.0 contain a critical authentication bypass vulnerability within the optional MOOSDB HTTP server component. This service, which facilitates inter-process communication in autonomy-oriented systems, fails to enforce authentication checks for administrative requests. Consequently, unauthenticated remote attackers can send specially crafted HTTP requests to the MOOSDB service port to write, modify, or inject MOOS variables. This vulnerability is particularly severe because it allows for the unauthorized manipulation of system states, including the modification of actuator commands and override parameters. Successful exploitation grants attackers direct control over operational variables, potentially leading to the compromise of system integrity and safety in environments utilizing core-moos for autonomous decision-making.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.8. Exploitation could allow attackers to gain unauthorized control over system operations by injecting or modifying MOOS variables. This poses a significant risk to systems in marine robotics, autonomous vehicle research, and other sectors relying on core-moos, where unauthorized actuator changes could lead to loss of control, physical damage, or mission failure.

Recommendation

• Upgrade core-moos to the latest patched version when available to remediate CVE-2026-85428.
• Implement network-level segmentation to restrict access to the MOOSDB HTTP server port (default 9000-9005 range) to authorized management IPs only.
• Audit network traffic for unauthorized HTTP traffic directed at the MOOSDB service port.